Live DevOps Security Brief for August 1, 2026: Pipelines, Dependencies, and Secrets

CVE-2026-54725: vault-addr annotation SSRF — webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

GitHub Advisory Database | July 31, 2026 | CRITICAL | CVSS 9.6 | GitHub Advisory Database github.com/bank-vaults/vault-secrets-webhook

## Summary The vault-secrets-webhook reads the `vault.security.banzaicloud.io/vault-addr` annotation from any ConfigMap or Secret being admitted and uses it as the Vault server address without any validation or allowlist. When a ConfigMap or Secret contains a value prefixed with `vault:`, the webhook's admission handler synchronously calls the Vault API at the attacker-supplied address from inside the webhook process during…

Why it matters: GitHub Advisory Database github.com/bank-vaults/vault-secrets-webhook participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Operational focus: Identify whether untrusted repository content can reach privileged runners, tokens, or deployment tools.

Open the original GitHub Advisory Database record

CVE-2026-62324: Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

GitHub Advisory Database | August 1, 2026 | MEDIUM | CVSS 5.4 | GitHub Advisory Database jodit

### Summary jodit's `sanitizeHTMLElement` neutralizes a `javascript:` `href` using a bare `href.trim().indexOf('javascript') === 0` check. This omits the normalization jodit applies to every other URL attribute: `isDangerousUrl` strips control bytes with `value.replace(/[\u0000-\u0020]+/g, '')` and lowercases the value before testing the scheme. Because the `href` check does neither, it is bypassed by three obfuscation classes, all confirmed firing on…

Why it matters: GitHub Advisory Database jodit participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Operational focus: Check dependency reachability and fixed versions before blocking or approving a release.

Open the original GitHub Advisory Database record

CVE-2026-54706: OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

GitHub Advisory Database | July 31, 2026 | MEDIUM | CVSS 4.8 | GitHub Advisory Database onionshare-cli

### Summary OnionShare CLI/Desktop 2.6.3 can follow symbolic links inside a selected Share or Website directory and serve the symlink target rather than limiting access to files physically contained in the selected directory. If a user shares a directory that contains attacker-supplied or otherwise untrusted symlinks, a remote recipient with access to the OnionShare service can read arbitrary…

Why it matters: GitHub Advisory Database onionshare-cli participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.